Quantum Information and Computation, Vol. 0, No.

0 (2005) 000–000
c Rinton Press

THE SOLOVAY-KITAEV ALGORITHM

CHRISTOPHER M. DAWSON
School of Physical Sciences, The University of Queensland,
arXiv:quant-ph/0505030v2 23 Aug 2005

Brisbane, Queensland 4072, Australia

MICHAEL A. NIELSEN
School of Physical Sciences, The University of Queensland,
Brisbane, Queensland 4072, Australia

Received November 26, 2024

Revised

This pedagogical review presents the proof of the Solovay-Kitaev theorem in the form of
an efficient classical algorithm for compiling an arbitrary single-qubit gate into a sequence
of gates from a fixed and finite set. The algorithm can be used, for example, to compile
Shor’s algorithm, which uses rotations of π/2k , into an efficient fault-tolerant form using
only Hadamard, controlled-not, and π/8 gates. The algorithm runs in O(log2.71 (1/ǫ))
time, and produces as output a sequence of O(log3.97 (1/ǫ)) quantum gates which is
guaranteed to approximate the desired quantum gate to an accuracy within ǫ > 0. We
also explain how the algorithm can be generalized to apply to multi-qubit gates and to
gates from SU (d).

Keywords: Solovay-Kitaev algorithm, universality, fault-tolerance

1 Introduction
“I have been impressed by numerous instances of mathematical theories that are
really about particular algorithms; these theories are typically formulated in math-
ematical terms that are much more cumbersome and less natural than the equiva-
lent formulation today’s computer scientists would use.” — Donald E. Knuth [16]

The Solovay-Kitaev (SK) theorem is one of the most important fundamental results in the
theory of quantum computation. In its simplest form the SK theorem shows that, roughly
speaking, if a set of single-qubit quantum gates generates a dense subset of SU (2), then that
set is guaranteed to fill SU (2) quickly, i.e., it is possible to obtain good approximations to
any desired gate using surprisingly short sequences of gates from the given generating set.
The SK theorem is important if one wishes to apply a wide variety of different single-qubit
gates during a quantum algorithm, but is restricted to use gates from a more limited reper-
toire. Such a situation arises naturally in the context of fault-tolerant quantum computation,
where direct fault-tolerant constructions are typically available only for a limited number of
gates (e.g., the Clifford group gates and π/8 gate), but one may wish to implement a wider
variety of gates, such as the π/2k rotations occurring in Shor’s algorithm [22, 23]. In this sit-
uation one must use the limited set of fault-tolerant gates to build up accurate fault-tolerant

1
2 The Solovay-Kitaev algorithm . . .

approximations to all the gates used in the algorithm, preferably in the most efficient manner
possible. The SK theorem tells us that such efficient constructions are possible.
The purpose of the present paper is to present the proof of the SK theorem in the form of
a concrete algorithm which can be used to approximate a desired unitary, U , using a given set
of quantum gates. We believe that this algorithmic perspective is useful in its own right, and,
as the quote by Knuth suggests, also makes the ideas behind the SK theorem considerably
easier to understand than in previous presentations. However, we stress that the paper is a
review paper, as all the essential ideas appear in previous work; a detailed history of the SK
theorem and algorithm is given in Section 6.
The structure of the paper is as follows. Section 2 introduces the fundamental defini-
tions needed to understand the SK theorem and algorithm, and provides a formal statement
of the SK theorem. Section 3 explains the SK algorithm for qubits, in the form of nine
easily-understood lines of pseudocode. This section concentrates on developing a broad un-
derstanding of how the SK algorithm works. The few remaining details of the algorithm which
need verification are explained in Section 4. Section 5 extends the algorithm so it applies also
to qudits, i.e., quantum systems with d-dimensional state spaces. As a special case we ob-
tain a version of the SK algorithm applicable to multiple qubits, simply by setting d = 2n .
Section 6 discusses the relationship of the results we have presented to prior work on the SK
theorem. This placement of the discussion of prior work is perhaps somewhat unusual, and
deserves comment: we chose to defer the discussion until late in the paper in order to make
the comparisons between the present paper and prior work as concrete and transparent as
possible. Section 7 concludes.

2 Fundamentals
In this section we introduce the fundamental definitions necessary to understand the SK
theorem and algorithm, and give a precise statement of the SK theorem.
The basic goal of the SK algorithm is to take an arbitrary quantum gate U and find a
good approximation to it using a sequence of gates g1 , . . . , gm drawn from some finite set
G. In analogy with classical computation, where an algorithm written in a programming
language such as C or Perl must be compiled into a sequence of instructions in the native
machine language, we will call the set G of quantum gates an instruction set, and the process
of finding good approximations compilation. Note that while this nomenclature, introduced
in [10], is inspired by classical computer science, the analogies between the classical and
quantum concepts are obviously somewhat imprecise, and should not be taken too seriously.
Let’s define these concepts more precisely, beginning with instruction sets:
Definition 1 An instruction set G for a d-dimensional qudit is a finite set of quantum
gates satisfying:

1. All gates g ∈ G are in SU (d), that is, they are unitary and have determinant 1.

2. For each g ∈ G the inverse operation g † is also in G.

3. G is a universal set for SU (d), i.e., the group generated by G is dense in SU (d). This
means that given any quantum gate U ∈ SU (d) and any accuracy ǫ > 0 there exists a
product S ≡ g1 . . . gm of gates from G which is an ǫ-approximation to U .
 Christopher M. Dawson and Michael A. Nielsen. . . 3

The notion of approximation being used in this definition, and throughout this paper, is
approximation in operator norm. That is, a sequence of instructions generating a unitary
operation S is said to be an ǫ-approximation to a quantum gate U if d(U, S) ≡ kU − Sk ≡
supkψk=1 k(U − S)ψk < ǫ. In different contexts we will find it convenient to use both the
operator norm k · k, and the associated distance function d(·, ·). Another convenient notation
is to use S to refer both to a sequence of instructions, g1 , g2 , . . . gm , and also to the unitary
operation g1 g2 . . . gm corresponding to that sequence. With this convention the “sequence”
g1 , g2 , . . . corresponds to the unitary formed by applying g1 , g2 , . . . in the reverse order. While
this is somewhat nonintuitive, in later use it will prove to be the simplest and most natural
convention.
We assume the reader is familiar with the elementary properties of the operator norm,
which we will mostly use without note. One perhaps somewhat less familiar property we’ll
have occasion to use is that if H is Hermitian then d(I, exp(iH)) = maxE 2 sin(|E|/2), where
the maximum is over all eigenvalues E of H. From this it follows easily that d(I, exp(iH)) ≤
kHk. Furthermore, provided all the eigenvalues are in the range −π to π it follows that
d(I, exp(iH)) = kHk + O(kHk3 ).
It is easy to understand the motivation behind parts 1 and 3 of our definition of an
instruction set. Less clear is the reason for part 2, namely, the requirement that if g ∈ G
then we must also have g † ∈ G. Our reason for imposing this requirement is that it is used in
the proof of the SK theorem, not for any a priori reason. In particular, we will make use of
the easily-verified fact that if we have an instruction sequence providing an ǫ-approximation
to some unitary U , then we can obtain an ǫ-approximation to U † simply by reversing the
order of the sequence, and applying the corresponding inverse instructions. It appears to be
an open problem whether a result analogous to the SK theorem holds when condition 2 is
relaxed.
The problem of quantum compilation may now be stated more precisely: given an in-
struction set, G, how may we approximate an arbitrary quantum gate with a sequence of
instructions from G; how does the sequence length increase as we require more accurate ap-
proximations; and how quickly may we find such an approximating sequence? These final two
questions are vitally important, as an inaccurate or inefficient quantum compiler may negate
any improvements quantum computers have over classical computers.
As an illustration, suppose we have a quantum algorithm, such as Shor’s, which can be
broken up into a sequence of m quantum gates, U1 , . . . , Um . However, let us also suppose that
not all of those quantum gates are in our instruction set, and so it is necessary to compile
the algorithm so that each gate Uj is re-expressed in terms of the available instruction set.
If the compiled algorithm is required to approximate the original to within ǫ, then it is
sufficient that each gate Uj be approximated to an accuracy ǫ/m [3]. If we make the a
priori reasonable assumption [20] that an accuracy of δ > 0 requires an instruction sequence
of length O(1/δ), then each gate Uj will require a sequence of length O(m/ǫ), and so the
total number of instructions required to implement the algorithm is O(m2 /ǫ) — a quadratic
increase in the complexity of the algorithm. For quantum algorithms such as Grover’s search
algorithm [7, 8], which purports to give a quadratic increase over the best classical algorithm,
this may be problematic if the available instruction set does not coincide with the gates used
in the algorithm.
4 The Solovay-Kitaev algorithm . . .

The SK theorem may be stated as follows:

Theorem 1 (Solovay-Kitaev) Let G be an instruction set for SU (d), and let a desired
accuracy ǫ > 0 be given. There is a constant c such that for any U ∈ SU (d) there exists a
finite sequence S of gates from G of length O(logc (1/ǫ)) and such that d(U, S) < ǫ.
Different proofs of the theorem give different values for c; the proof we describe gives
c ≈ 3.97. We discuss some other proofs (and their corresponding values of c) in Section 6.
A critical issue not addressed in this statement of the SK theorem is the question of
how efficiently the approximating sequence S may be found on a classical computer. The
SK algorithm both provides a proof of the SK theorem, and also shows that an approxi-
mating sequence S may be found efficiently on a classical computer, with a running time of
O(log2.71 (1/ǫ)).
At first sight it appears paradoxical that the SK algorithm can produce as output a
gate sequence of length O(log3.97 (1/ǫ)) in the asymptotically shorter time O(log2.71 (1/ǫ)).
We will see that the reason this is possible is because the gate sequence has considerable
redundancy, enabling the output to be substantially compressed, i.e., not all the gates need
be explicitly output. When this compression is not done, the SK algorithm runs instead in
time O(log3.97 (1/ǫ)). Regardless of which method is used, the key point is that the running
time is polylogarithmic in 1/ǫ.
Returning to our earlier example, suppose we have a quantum algorithm expressed in
terms of quantum gates U1 , . . . , Um . If we wish for the compiled algorithm to have accuracy
ǫ, then each gate needs accuracy ǫ/m. Using the SK algorithm this can be achieved using
a sequence of O(log3.97 (m/ǫ)) quantum gates, and a running time of O(log2.71 (m/ǫ)) on a
classical computer. The total number of instructions required to implement the algorithm is
therefore O(m log3.97 (m/ǫ)), with an associated classical compile time of O(m log2.71 (m/ǫ)).
Thus, the SK algorithm reduces the overhead due to quantum compilation from quadratic to
polylogarithmic, which is much more acceptable.

3 The Solovay-Kitaev algorithm for qubits

In this section we present the main ideas used in the SK algorithm. At the conclusion of the
section the reader should have a good broad understanding of how and why the algorithm
works. Rigorous verification of a few details has been deferred until the next section, in order
that those details not obscure the big picture. We also restrict our attention in this section to
that form of the SK theorem which applies to qubits. The extension to qudits involves some
new ideas, and is described in Section 5.
The SK algorithm may be expressed in nine lines of pseudocode. We explain each of these
lines in detail below, but present it here in its entirety both for the reader’s reference, and to
stress the conceptual simplicity of the algorithm:

function Solovay-Kitaev(Gate U , depth n)

if (n == 0)
Return Basic Approximation to U
else
Set Un−1 = Solovay-Kitaev(U ,n − 1)
†
Set V , W = GC-Decompose(U Un−1 )
 Christopher M. Dawson and Michael A. Nielsen. . . 5

Set Vn−1 = Solovay-Kitaev(V ,n − 1)

Set Wn−1 = Solovay-Kitaev(W ,n − 1)
† †
Return Un = Vn−1 Wn−1 Vn−1 Wn−1 Un−1 ;

Let’s examine each of these lines in detail. The first line:

function Solovay-Kitaev(Gate U , depth n)

indicates that the algorithm is a function with two inputs: an arbitrary single-qubit quan-
tum gate, U , which we desire to approximate, and a non-negative integer, n, which controls
the accuracy of the approximation. The function returns a sequence of instructions which
approximates U to an accuracy ǫn , where ǫn is a decreasing function of n, so that as n gets
larger, the accuracy gets better, with ǫn → 0 as n → ∞. We describe ǫn in detail below.
The Solovay-Kitaev function is recursive, so that to obtain an ǫn -approximation to U ,
it will call itself to obtain ǫn−1 -approximations to certain unitaries. The recursion terminates
at n = 0, beyond which no further recursive calls are made:

if (n == 0)
Return Basic Approximation to U

In order to implement this step we assume that a preprocessing stage has been completed
which allows us to find a basic ǫ0 -approximation to arbitrary U ∈ SU (2). Since ǫ0 is a
constant, in principle this preprocessing stage may be accomplished simply by enumerating
and storing a large number of instruction sequences from G, say up to some sufficiently large
(but fixed) length l0 , and then providing a lookup routine which, given U , returns the closest
sequence. Appropriate values for ǫ0 and l0 will be discussed later in this section.
At higher levels of recursion, to find an ǫn -approximation to U , we begin by finding an
ǫn−1 -approximation to U :

else
Set Un−1 = Solovay-Kitaev(U ,n − 1)

We will use Un−1 as a step towards finding an improved approximation to U . Defining

†
∆ ≡ U Un−1 , the next three steps of the algorithm aim to find an ǫn -approximation to ∆,
where ǫn is some improved level of accuracy, i.e., ǫn < ǫn−1 . Finding such an approxima-
tion also enables us to obtain an ǫn -approximation to U , simply by concatenating our exact
sequence of instructions for Un−1 with our ǫn -approximating sequence for ∆.
How do we find such an approximation to ∆? First, observe that ∆ is within a distance
ǫn−1 of the identity. This follows from the definition of ∆ and the fact that Un−1 is within a
distance ǫn−1 of U .
Second, decompose ∆ as a group commutator ∆ = V W V † W † of unitary gates V and
W . For any ∆ it turns out — this is not obvious — that there is always an infinite set of
choices for V and W such that ∆ = V W V † W † . For our purposes it is important that we
√
find V and W such that d(I, V ), d(I, W ) < cgc ǫn−1 for some constant cgc . We call such
6 The Solovay-Kitaev algorithm . . .

a decomposition a balanced group commutator. In Subsection 4.1 we will use the fact that
d(I, ∆) < ǫn−1 to show that such a balanced group commutator can always be found:

†
Set V , W = GC-Decompose(U Un−1)

For practical implementations we will see below that it is √ useful to have cgc as small as
possible; the arguments of Subsection 4.1 show that cgc ≈ 1/ 2.
The next step is to find instruction sequences which are ǫn−1 -approximations to V and W :

Set Vn−1 = Solovay-Kitaev(V ,n − 1)

Set Wn−1 = Solovay-Kitaev(W ,n − 1)

Remarkably, in Subsection 4.2 we show that the group commutator of Vn−1 and Wn−1 turns
3/2
out to be an ǫn ≡ capprox ǫn−1 -approximation to ∆, for some small constant capprox . Provided
ǫn−1 < 1/c2approx , we see that ǫn < ǫn−1 , and this procedure therefore provides an improved
approximation to ∆, and thus to U . This is surprising, since we are using imperfect ap-
proximations to V and W to obtain an improved approximation to the group commutator
V W V † W † . We will see in Subsection 4.2 that the reason this improved approximation is
possible is because of cancellation of error terms in the group commutator.
The constant capprox is important as it determines the precision ǫ0 required of the initial
approximations. In particular, we see that for this construction to guarantee that ǫ0 > ǫ1 > . . .
we must√have ǫ0 < 1/c2approx . Following the discussion in Subsection 4.2, we obtain capprox ≈
8cgc ≈ 4 2 and therefore require ǫ0 < 1/32. Of course, the analysis in Subsection 4.2 simply
bounds capprox , and it is possible that a more detailed analysis will give better bounds on
capprox , and thus on ǫ0 . Numerically we have found that for the single-qubit instruction set
consisting of the Hadamard gate, the π/8 gate, and its inverse, ǫ0 ≈ 0.14 and l0 = 16 is
sufficient for practical purposes.
The algorithm concludes by returning the sequences approximating the group commuta-
tor, as well as Un−1 :

† †
Return Un = Vn−1 Wn−1 Vn−1 Wn−1 Un−1 ;

Summing up, the function Solovay-Kitaev(U, n) returns a sequence which provides an

3/2
ǫn = capprox ǫn−1 -approximation to the desired unitary U . The five constituents in this se-
quence are all obtained by calling the function at the n − 1th level of recursion.
Analysis: We now analyse the runtime of the SK algorithm, and the accuracy of the
approximating sequence of instructions. Let ln be the length of the sequence of instructions
returned by Solovay-Kitaev(U, n), and let tn be the corresponding runtime. Inspection of
the pseudocode and the above discussion shows that we have the recurrences
3/2
ǫn = capprox ǫn−1 (1)
ln = 5ln−1 (2)
tn ≤ 3tn−1 + const, (3)

where the constant overhead in tn comes from the need to perform tasks like finding the
 Christopher M. Dawson and Michael A. Nielsen. . . 7

balanced group commutator, and other small overheads in the pseudocode. Note that the
cost of doing tn is assumed to come entirely from the calls to Solovay-Kitaev(., n-1), and
we have assigned a constant cost for the final line of the algorithm, which returns the new
sequence Un . This assumption is justified if the final line is implemented using pointers to the
output from the earlier calls to Solovay-Kitaev(., n-1), rather than returning an actual
sequence of gates. This enables us to avoid explicitly returning the (redundant) sequences
† †
for Vn−1 and Wn−1 . If this is not done, then this analysis needs a little modification; we
won’t go through the details, but the end result is that the time and length both scale as
O(log3.97 (1/ǫ)). Assuming that pointers have been used, the recurrences above imply:

1
( 32 )n
ǫn = ǫ0 c2approx . (4)
c2approx
ln = O(5n ) (5)
n
tn = O(3 ). (6)

To obtain a given accuracy ǫ it follows that we must choose n to satisfy the equation:
 h i
ln(1/ǫc2approx )
ln 2
ln(1/ǫ0 capprox ) 
n= . (7)

 ln(3/2) 
 

Substituting this value of n back into Eqs. (5) and (6) we obtain expressions for the length of
the approximating sequence and the time of execution, now as a function of ǫ rather than n:
 
lǫ = O lnln 5/ ln(3/2) (1/ǫ) (8)
 
tǫ = O lnln 3/ ln(3/2) (1/ǫ) . (9)

These are the desired expressions for the length and execution time. Note that the exponent
in the first expression is ln 5/ ln(3/2) ≈ 3.97, while the exponent in the second expression is
ln 3/ ln(3/2) ≈ 2.71.
A caveat to this discussion is that we have entirely ignored the precision with which
arithmetical operations are carried out. In practice we cannot compute with precisely specified
unitary operations, since such operations in general require an infinite amount of classical
information to specify. Instead, we must work with approximations to such operations, and do
all our calculations using finite precision arithmetic. A complete analysis of the SK algorithm
should include an account of the cost of such approximations. In practice, we have found that
for the values of precision of most interest to us, standard floating-point arithmetic works
admirably well, and there seems to be little need for such an analysis.

4 Verification of details
In this section we verify those details of the SK algorithm not fully explained in the previous
section. Subsection 4.1 describes how to find balanced group commutators generating a
desired unitary, while Subsection 4.2 discusses the error in the group commutator V W V † W †
when only approximations to the constituent unitaries are available.
8 The Solovay-Kitaev algorithm . . .

4.1 Balanced commutators in SU (2)

The earlier discussion of balanced group commutators was in a somewhat specialized nota-
tion, which arose out of the application to the Solovay-Kitaev algorithm. To emphasize the
generality of the results in this subsection we will use a more generic notation. In particular,
suppose U ∈ SU (2) satisfies d(I, U ) < ǫ. Our goal is to find V and W so that the group com-
√
mutator satisfies V W V † W † = U , and such that d(I, V ), d(I, W ) < cgc ǫ for some constant
cgc .
In order to find such a V and W we first examine what seems like a special case. In
particular, we choose V to be a rotation by an angle φ about the x̂ axis of the Bloch sphere,
and W to be a rotation by an angle φ about the ŷ axis of the Bloch sphere. The resulting
group commutator V W V † W † is a rotation about some axis n̂ on the Bloch sphere, by an
angle θ satisfying:
q
sin(θ/2) = 2 sin2 (φ/2) 1 − sin4 (φ/2). (10)

There are many ways of verifying Eq. (10), including simple brute force calculation, perhaps
with the aid of a computer mathematics package. One somewhat more elegant way of verifying
Eq. (10) is as follows. First, observe that V † is a rotation by an angle φ about the −x̂ axis,
and thus W V † W † must be a rotation by an angle φ about the axis m̂ that results when −x̂
is rotated by an angle φ about the ŷ axis. That is, m̂(− cos(φ), 0, sin(φ)). The commutator
V (W V † W † ) is thus the composition of these two rotations. The resulting angle of rotation is
easy to calculate (see, e.g., Exercise 4.15 on page 177 of [19]), with Eq. (10) the result after
some simplification. The exact form of the axis of rotation, n̂, is not so important for our
purposes, but it is easily computed using similar techniques.
We can easily invert this construction. Suppose now that U is a rotation by an arbitrary
angle θ about an arbitrary axis p̂ on the Bloch sphere. Define φ to be a solution to Eq. (10)
for the given value of θ, and define V and W to be rotations by φ about the x̂ and ŷ axes of
the Bloch sphere. Then it is easy to see that U must be conjugate to a rotation by θ about
the n̂ axis identified in the previous two paragraphs, i.e., U = S(V W V † W † )S † , for some
easily-computed unitary S. It follows that

U = Ṽ W̃ Ṽ † W̃ † , (11)

where Ṽ ≡ SV S † and W̃ ≡ SW S † . Thus, we can express any unitary U rotating the Bloch
sphere by an angle θ as the group commutator of unitaries V and W which rotate the Bloch
sphere by an angle φ, providing θ and φ are related by Eq. (10).
To conclude the argument, note that for a unitary T rotating the Bloch sphere by an angle
τ , the distance to the identity satisfies d(I, T ) = 2 sin(τ /4) = τ /2 + O(τ 3 ). Combining this
observation with Eq. (10), we see that for U near the identity we can express U in terms of a
group commutator of V and W satisfying d(I, U ) ≈ 2d(I, V )2 = 2d(I, W )2 . That is, we have:

U = V W V †W † (12)
r r
d(I, U ) ǫ
d(I, V ) = d(I, W ) ≈ < . (13)
2 2
√
This is the desired balanced group commutator, and gives cgc ≈ 1/ 2. This argument can
 Christopher M. Dawson and Michael A. Nielsen. . . 9

also easily be modified to give a more rigorous bound on cgc . The details are tedious, but
easy to supply, and so we won’t do this here.

4.2 Approximating a commutator

Just as in the last subsection, for clarity we state the main result of this subsection in general
terms, rather than in the special notation used in Section 3.
Lemma 1 Suppose V, W, Ṽ , and W̃ are unitaries such that d(V, Ṽ ), d(W, W̃ ) < ∆, and also
d(I, V ), d(I, W ) < δ. Then:
d(V W V † W † , Ṽ W̃ Ṽ † W̃ † ) < 8∆δ + 4∆δ 2 + 8∆2 + 4∆3 + ∆4 .
(14)
√
In applying this lemma to the SK algorithm, we replace ∆ by ǫn−1 , and δ by cgc ǫn−1 .
This gives rise to the inequality:
3/2
d(V W V † W † , Ṽ W̃ Ṽ † W̃ † ) < capprox ǫn−1 , (15)
where capprox ≈ 8cgc . With a little more detailed work we can modify this argument to give
a rigorous upper bound on capprox . However, just as in the last subsection, the details of this
argument are tedious and not especially enlightening, but easy to supply, and so we won’t do
this here.
Proof: We begin by writing Ṽ = V + ∆V , W̃ W + ∆W , which gives:
Ṽ W̃ Ṽ † W̃ † = V W V † W † + ∆V W V † W † + V ∆W V † W † + V W ∆†V W † + V W V † ∆†W
+O(∆2 ) + O(∆3 ) + O(∆4 ). (16)
2 † † 4
= 6 such terms. The O(∆3 )


The O(∆ ) terms are terms like ∆V ∆W V W . There are 2
terms are terms like ∆V ∆W ∆†V W † , of which there are 43 = 4 terms. There is just a single

O(∆4 ) term, ∆V ∆W ∆†V ∆†W . It follows from these observations, Eq. (16), and the triangle
inequality that:
d(V W V † W † , Ṽ W̃ Ṽ † W̃ † ) < k∆V W V † W † + V ∆W V † W † + V W ∆†V W † + V W V † ∆†W k
+6∆2 + 4∆3 + ∆4 . (17)
To complete the proof it suffices to prove that k∆V W V † W † +V W ∆†V W † k < ∆2 +4∆δ+2∆δ 2
and kV ∆W V † W † + V W V † ∆†W k < ∆2 + 4∆δ + 2∆δ 2 . The proofs of the two results are
analogous, with the roles of V and W interchanged, and so we only provide the details of the
first proof. We expand W = I + δW , so that
∆V W V † W † + V W ∆†V W † ∆V V † + V ∆†V + O(∆δ) + O(∆δ 2 ). (18)
In this expression the O(∆δ) terms are terms like ∆V δW V † W † . By inspection we see that
†
there are four such terms. The O(∆δ 2 ) terms are terms like ∆V δW V † δW , and, again by
inspection, we see that there are two such terms. It follows that:
k∆V W V † W † + V W ∆†V W † k < k∆V V † + V ∆†V k + 4∆δ + 2∆δ 2 . (19)
The unitarity of V and V + ∆V implies that ∆V V † + V ∆†V = −∆V ∆†V . Combining these
observations and using the triangle inequality we obtain
k∆V W V † W † + V W ∆†V W † k < ∆2 + 4∆δ + 2∆δ 2 , (20)
which completes the proof of the lemma.
10 The Solovay-Kitaev algorithm . . .

5 The Solovay-Kitaev algorithm for qudits

In this section we present a generalization of the SK algorithm that can be applied to qudits,
i.e., to d × d unitary gates. The main difference is in the group commutator decomposition.
In Subsection 5.1 we give a broad description of the modified algorithm, and in Subsection 5.2
we describe the modified group commutator decomposition.

5.1 The modified algorithm

The modified pseudocode for the qudit SK algorithm is as follows:

function Solovay-Kitaev(Gate U , depth n)

if (n == 0)
Return Basic Approximation to U
else
Set Un−1 = Solovay-Kitaev(U ,n − 1)
†
Set V , W = GC-Approx-Decompose(U Un−1 )
Set Vn−1 = Solovay-Kitaev(V ,n − 1)
Set Wn−1 = Solovay-Kitaev(W ,n − 1)
† †
Return Un = Vn−1 Wn−1 Vn−1 Wn−1 Un−1 ;

Comparing with the earlier pseudocode for the qubit SK algorithm, we see that the only
explicit difference is in the line taking the group commutator:

†
Set V , W = GC-Approx-Decompose(U Un−1)

Recall that in the qubit algorithm the corresponding line finds a balanced group commu-
†
tator decomposition, i.e., finds V and W such that (a) V W V † W † = ∆ ≡ U Un−1 , and (b)
√
d(I, V ), d(I, W ) < cgc ǫn−1 for some constant cgc .
In the qudit algorithm this line finds a balanced group commutator which approximates ∆.
3/2
More precisely, we find V and W such that (a) d(V W V † W † , ∆) < cgc′ ǫn−1 , for some constant
√
cgc′ , and (b) d(I, V ), d(I, W ) < cgc′′ ǫn−1 for some constant cgc′′ . The explicit procedure for
doing this is explained in Subsection 5.2, which shows that cgc′ ≈ 4d3/4 ((d − 1)/2)3/2 and
cgc′′ ≈ d1/4 ((d − 1)/2)1/2 , where d is the dimensionality of the Hilbert space we are working
in.
The remaining lines work just as in the qubit algorithm, finding instruction sequences Vn−1
and Wn−1 which are ǫn−1 -approximations to ∆, and then returning the group commutator
corresponding to those sequences, together with the sequence for Un−1 , as the output of the
algorithm:

Set Vn−1 = Solovay-Kitaev(V ,n − 1)

Set Wn−1 = Solovay-Kitaev(W ,n − 1)
† †
Return Un = Vn−1 Wn−1 Vn−1 Wn−1 Un−1 ;

Although the steps are the same, the analysis is a little different, due to the fact that the
 Christopher M. Dawson and Michael A. Nielsen. . . 11

group commutator of V and W only approximates ∆. In particular, we have

† † † †
d(Vn−1 Wn−1 Vn−1 Wn−1 , ∆) ≤ d(Vn−1 Wn−1 Vn−1 Wn−1 , V W V † W † ) + d(V W V † W † , ∆)
(21)
3/2
< (cgc′ + capprox ) ǫn−1 , (22)

where capprox is the same constant that arose in the qubit algorithm (Subsection 4.2), where
we estimated capprox ≈ 8cgc′′ , in the notation of the current section. Thus, just as for the
3/2
qubit algorithm, the qudit algorithm returns a sequence Un which provides an ǫn = O(ǫn−1 )-
approximation to the desired unitary, U . Furthermore, the five constituents in the sequence
are all obtained by calling the function at the n − 1th level of recursion, just as in the qubit
algorithm.
The analysis of the accuracy and running time of the qudit  SK algorithm proceeds in
a fashion analogous to the qubit algorithm, giving lǫ = O lnln 5/ ln(3/2) (1/ǫ) and tǫ =
 
O lnln 3/ ln(3/2) (1/ǫ) . An important practical caveat concerns the difficulty of construct-
ing the lookup table used to obtain the basic ǫ0 -approximations. This is done by enumerating
all possible gate sequences up to some sufficient length. SU (d) is a manifold of dimension
d2 − 1, so if we wish to approximate every gate in SU (d) to within ǫ0 then we generate
2
O(1/ǫ0d −1 ) sequences. For an instruction set G there are O(|G|l ) sequences of length ≤ l,
some fraction of which may be redundant. We will therefore need to enumerate all sequences
up to a length l0 satisfying  2 
d −1
l0 ≥ O log(1/ǫ0 ) . (23)
log |G|
The complexity of the enumeration is exponential in l0 and thus scales quite poorly with
d. While our algorithm is practical for the small values of d of most interest in applications
to fault-tolerance (e.g., d = 2, 3, 4), it will require great computational effort to scale it to
substantially larger values of d.

5.2 Balanced commutators in SU (d)

In this subsection our goal is to show that if U satisfies d(I, U ) < ǫ then there exist V and
√
W satisfying d(V W V † W † , U ) < cgc′ ǫ3/2 and such that d(I, V ), d(I, W ) < cgc′′ ǫ, for some
constants cgc′ and cgc′′ . The proof combines two lemmas.
Lemma 2 (Based on Theorem 4.5.2 on page 288 of [11]) Let H be a traceless d-dimensional
Hermitian matrix. Then we can find Hermitian F and G such that:

[F, G] = iH (24)
 1/2
d−1
kF k, kGk ≤ d1/4
p
kHk. (25)
2

A variant of this lemma may be found in Problem p 8.15 on page 79 of [14]. The variant
in [14] has the advantage that the prefactor to kHk on the right-hand side of Eq. (25) is
replaced by a constant that does not depend on d. We use the present version since the proof
is a little simpler, and it suffices to establish the correctness of the SK algorithm. Readers
serious about optimizing this aspect of the SK algorithm should consult [14] for details.
12 The Solovay-Kitaev algorithm . . .

Proof: It is convenient to work in a basis which is Fourier conjugate to the basis in which
H is diagonal. (This can, of course, be done, since the commutator bracket is preserved under
conjugation, i.e., S[A, B]S † = [SAS † , SBS † ] for any matrices A and B, and any unitary S.)
In this basis H has the representation

H = W diag(E1 , . . . , Ed )W † , (26)

where E1 , . .√
. , Ed are the eigenvalues of H, and W is the Fourier matrix, with elements
Wjk ≡ ω jk / d, where ω ≡ exp(2πi/d) is a dth root of unity. From Eq. (26) we see that in
this basis the diagonal matrix elements of H vanish:
∗
ω jk Ek ω jk
P P
k k Ek tr(H)
Hjj = = = = 0. (27)
d d d
As a trial solution to the equation [F, G] = iH we will assume that G is some diagonal matrix,
with real entries. The condition [F, G]iH is then equivalent to iHjk = Fjk (Gkk − Gjj ). This
suggests imposing the condition that the diagonal entries of G all be distinct, and defining
(
iHjk
Gkk −Gjj if j 6= k;
Fjk ≡ (28)
0 if j = k.

It is easy to see that with these choices F and G are Hermitian, and satisfy [F, G] = iH.
What of the norms kF k and kGk? Suppose we choose the diagonal entries of G as −(d −
1)/2, −(d − 1)/2 + 1, . . . , (d − 1)/2. With this choice it is clear from our definition that the
entries of F satisfy |Fjk | ≤ |Hjk |, and we have

kF k2 ≤ tr(F 2 ) (29)
2
≤ tr(H ) (30)
2
≤ dkHk , (31)

where the first and third inequalities follow easily from the definitions, and the second in-
equalitypfollows from the fact that |Fjk | ≤ |Hjk |. With these choices we therefore have
kF k ≤ dkHk and kGk = (d − 1)/2. Rescaling F and G appropriately we can ensure that
the equation [F, G] = iH remains satisfied, while satisfying Eq. (25). This completes the
proof.
Lemma 3 Suppose F and G are Hermitian matrices such that kF k, kGk < δ. Then:

d (exp(iF ) exp(iG) exp(−iF ) exp(−iG), exp(i × i[F, G])) ≤ c1 δ 3 , (32)

for some constant c1 ≈ 4.

Proof: This is easily verified using the standard series expansion for matrix exponentials.
Alternately, this is also a standard result in the theory of Lie groups. See, e.g., Proposition 2
on page 25 in Section 1.3 of [21].
The result we desire may be obtained by combining these two lemmas. Suppose d(I, U ) <
ǫ. We can find Hermitian H such that U exp(iH) and d(I, U ) = kHk + O(kHk3 ). By
√
Lemma 2 we can find Hermitian F and G such that [F, G] = iH, and kF k, kGk ≤ cgc′′ ǫ
 Christopher M. Dawson and Michael A. Nielsen. . . 13

p √
for cgc′′ ≈ d1/4 (d − 1)/2. Setting V ≡ exp(iF ), W ≡ exp(iG), δ ≡ cgc′′ ǫ and applying
Lemma 3, we obtain:
√
d(V W V † W † , U ) < c1 (cgc′′ ǫ)3 = cgc′ ǫ3/2 , (33)
√
where cgc′ = c1 c3gc′′ ≈ 4d3/4 ((d − 1)/2)3/2 . Furthermore, we have d(I, V ), d(I, W ) < cgc′′ ǫ,
as desired.

6 Prior work
The treatment of the SK theorem and algorithm given in this paper is based upon Appendix 3
in [19]. That appendix gave a detailed description of the SK theorem, and included an exercise
(Exercise A3.6) asking the reader to find an algorithm for efficiently finding accurate sequences
of instructions approximating a desired unitary. Reader feedback on [19] suggests that this
was not one of the easier exercises in that volume, a fact that partially inspired the present
review paper.
The history of the SK theorem and algorithm is interesting. For SU (2) the SK theorem
was announced by Solovay in 1995 on an email discussion list, but no paper has subsequently
appeared. Independently, in 1997 Kitaev [12] outlined a proof in a review paper, for the gen-
eral case of SU (d). After hearing of this result, Solovay announced that he had generalized his
proof in a similar fashion. Kitaev’s paper also addressed the question of efficient implementa-
tion, sketching out an algorithm to quickly find accurate instruction sequences approximating
a desired gate. The proof of the SK theorem given in [19] was based on [12], discussions with
Kitaev, Solovay, and M. Freedman, and on a 1999 lecture by Freedman, based on Kitaev’s
proof.
Kitaev’s 1997 discussion [12] of the SK theorem and algorithm is described and extended
in the 2002 text by Kitaev, Shen and Vyalyi [14]. Indeed, that text actually presents two
different approaches to the problem. The first approach, described in Section 8.3 of [14], uses
very similar ideas to the description we have given, with a few technical differences resulting
in somewhat different behaviour for the algorithm’s running time, and for the length of the
instruction sequences produced. In particular, the algorithm in [14] has a running time
O(log3+δ (1/ǫ)) and produces an instruction sequence of length O(log3+δ (1/ǫ), where δ can
be chosen to be any positive real number.
The second approach, described in Section 13.7 of [14], is quite different in flavour. It
modifies our setting for the SK theorem and algorithm in two ways: (1) it makes use of
ancilla qubits, and (2) it constrains the allowed instruction set somewhat, for example,
to Clifford group gates, together with the Toffoli gate; certain other instruction sets are
also possible, but not an arbitrary instruction set. A variant of Kitaev’s phase estima-
tion algorithm [15, 13] is used to construct instruction sequences providing exponentially
accurate conditional phase shifts. Standard constructions (e.g. [2]), together with these
phase shift gates, can then be used to approximate the desired gates. The running time
for this approach is O(log2 (1/ǫ) log(log(1/ǫ))), and the length of the instruction sequence is
O(log2 (1/ǫ) log(log(1/ǫ))). This approach also has the advantage of being easily parallelizable,
when acting on multiple qubits.
A non-constructive approach to the SK theorem was taken by Harrow, Recht and Chuang
in [9], based on Harrow’s undergraduate thesis [10] and papers by Arnold and Krylov [1],
14 The Solovay-Kitaev algorithm . . .

and by Lubotsky, Phillips and Sarnak [17, 18] (c.f. [6]). In particular, [9] proves that for
a suitable choice of instruction set, an approximation of accuracy ǫ may be achieved using
a sequence of O(log(1/ǫ)) instructions. It does not yet seem to be well understood exactly
which instruction sets achieve such a fast rate of convergence. Furthermore, [9] describe a
simple volume argument establishing that, up to a constant factor, it is not possible to obtain
shorter approximating sequences, and so this result is optimal. However, they do not provide
a constructive means of efficiently finding these short instruction sequences.
We conclude by noting two papers that, while not directly concerned with the SK theorem
or algorithm, are likely of interest to anyone interested in quantum compilation. The first is a
paper by Freedman, Kitaev, and Lurie [5], who develop some general conditions under which
a subset G of a semisimple Lie group G must generate a dense subset of G. In particular, they
introduce a natural family of metrics defined for any semisimple Lie group G, and show that
there is a universal constant c, independent of G, so that provided all points in G are within
a distance c of G, then G must generate a dense subset of G. Roughly speaking, provided G
“fills” G sufficiently well, it is guaranteed to generate a dense subset of G.
The second paper of interest is by Fowler [4], who investigates the feasibility of compil-
ing Shor’s algorithm into fault-tolerant form using a search technique that, while while not
“efficient” in the sense of the SK algorithm, in practice seems to yield promising results.

7 Conclusion
The Solovay-Kitaev theorem and algorithm are fundamental results in the theory of quan-
tum computation, and it seems likely that variants of these results will be used in future
implementations of quantum computers to compile quantum algorithms such as Shor’s into a
fault-tolerant form. The discussion of these results in the present review paper has been ped-
agogical, aimed at a formulation that brings out the key ideas, rather than being optimized
for accuracy and efficiency. It is an interesting open problem to determine the extent to which
these constructions can be improved, perhaps even developing a version of the Solovay-Kitaev
algorithm achieving optimal or near-optimal accuracy and efficiency.

Acknowledgments
We thank Mike Freedman, Aram Harrow, and Alexei Kitaev for enlightening discussions
about the Solovay-Kitaev theorem and algorithm, and to Mark de Burgh, Mark Dowling, and
Yeong Cherng Liang for helpful comments on a draft of the paper.

1. V. I. Arnold and A. L. Krylov. Soviet Math. Dokl., 4:1, 1962.

2. A. Barenco, C. H. Bennett, R. Cleve, D. P. DiVincenzo, N. Margolus, P. Shor, T. Sleator, J. A.
Smolin, and H. Weinfurter. Elementary gates for quantum computation. Phys. Rev. A, 52:3457–
3467, 1995. arXiv:quant-ph/9503016.
3. E. Bernstein and U. Vazirani. Quantum complexity theory. SIAM J. Comp., 26(5):1411–1473,
1997. arXiv:quant-ph/9701001.
4. A. G. Fowler. Constructing arbitrary single-qubit fault-tolerant gates. arXiv:quant-ph/0411206,
2004.
5. M. Freedman, A. Kitaev, and J. Lurie. Diameters of homogeneous spaces. arXiv:quant-
ph/0209113, 2002.
6. A. Gamburd, D. Jakobson, and P. Sarnak. Spectra of elements in the group ring of su(2). J. Eur.
math. Soc., 1(1):51–85, 1999.
 Christopher M. Dawson and Michael A. Nielsen. . . 15

7. Lov K. Grover. A fast quantum mechanical algorithm for database search. In 28th ACM Sympo-
sium on Theory of Computation, page 212, New York, 1996. Association for Computing Machinery.
8. Lov K. Grover. Quantum mechanics helps in searching for a needle in a haystack. Phys. Rev.
Lett., 79(2):325, 1997. arXiv:quant-ph/9706033.
9. A. Harrow, B. Recht, and I. L. Chuang. Efficient discrete approximations of quantum gates.
J. Math. Phys., 43:4445, 2002. arXiv:quant-ph/0111031.
10. A. W. Harrow. Quantum compiling. MIT undergraduate thesis, 2001.
11. R. A. Horn and C. R. Johnson. Topics in matrix analysis. Cambridge University Press, Cambridge,
1991.
12. A. Y. Kitaev. Quantum computations: algorithms and error correction. Russ. Math. Surv.,
52(6):1191–1249, 1997.
13. A. Y. Kitaev. Quantum error correction with imperfect gates. In A. S. Holevo O. Hirota and
C. M. Caves, editors, Quantum Communication, Computing, and Measurement, pages 181–188,
New York, 1997. Plenum Press.
14. A. Y. Kitaev, A. H. Shen, and M. N. Vyalyi. Classical and quantum computation, volume 47 of
Graduate Studies in Mathematics. American Mathematical Society, Providence, Rhode Island,
2002.
15. A. Yu. Kitaev. Quantum measurements and the Abelian stabilizer problem. arXiv:quant-
ph/9511026,, 1995.
16. D. E. Knuth. Computer science and its relation to mathematics. Amer. Math. Month., 81(4),
April 1974.
17. A. Lubotsky, R. Phillips, and P. Sarnak. Hecke operators and distributing points on the sphere i.
I. Comm. Pure Appl. Math., 39:S149–S186, 1986.
18. A. Lubotsky, R. Phillips, and P. Sarnak. Hecke operators and distributing points on the sphere
ii. I. Comm. Pure Appl. Math., 40:401–420, 1987.
19. M. A. Nielsen and I. L. Chuang. Quantum computation and quantum information. Cambridge
University Press, Cambridge, 2000.
20. J. Preskill. Reliable quantum computers. Proc. Roy. Soc. A: Math., Phys. and Eng.,
454(1969):385–410, 1998.
21. W. Rossmann. Lie Groups: An Introduction Through Linear Groups. Oxford University Press,
Oxford, 2002.
22. P. W. Shor. Algorithms for quantum computation: discrete logarithms and factoring. In Proceed-
ings, 35th Annual Symposium on Fundamentals of Computer Science, Los Alamitos, 1994. IEEE
Press.
23. P. W. Shor. Polynomial-time algorithms for prime factorization and discrete logarithms on a
quantum computer. SIAM J. Comp., 26(5):1484–1509, 1997.